Which concept refers to a gap that exists when the acceptable level of risk and the current state of risk are different?

Which concept refers to a gap that exists when the acceptable level of risk and the current state of risk are different?

• A. Risk gap
• B. Root cause analysis
• C. Continuous risk and control monitoring
• D. Penetration test

Answer: (A)

Risk gap refers to the mismatch between what the organization is willing to accept (risk appetite/t tolerance) and the current level of risk exposure. When controls and safeguards leave risk at or below the acceptable level, there’s no gap. But if the current risk is higher than what’s acceptable, a gap exists that signals the need for action—strengthening controls, changing processes, or adjusting risk tolerance. This concept helps explain why risk management focuses on aligning actual risk with targets set by leadership. The other options describe different ideas: root cause analysis digs into why a problem occurred, not the mismatch between acceptable and actual risk; continuous risk and control monitoring is about ongoing oversight to catch gaps and ensure controls stay effective, not the gap itself; and a penetration test is a method to identify vulnerabilities, not a term for the risk level mismatch.

Risk gap refers to the mismatch between what the organization is willing to accept (risk appetite/t tolerance) and the current level of risk exposure. When controls and safeguards leave risk at or below the acceptable level, there’s no gap. But if the current risk is higher than what’s acceptable, a gap exists that signals the need for action—strengthening controls, changing processes, or adjusting risk tolerance. This concept helps explain why risk management focuses on aligning actual risk with targets set by leadership.

The other options describe different ideas: root cause analysis digs into why a problem occurred, not the mismatch between acceptable and actual risk; continuous risk and control monitoring is about ongoing oversight to catch gaps and ensure controls stay effective, not the gap itself; and a penetration test is a method to identify vulnerabilities, not a term for the risk level mismatch.